Most small business websites that get hacked weren't picked out by anyone. Good website security for a firm of five or fifty mostly comes down to dull jobs done on time and knowing who holds the keys.
How small sites actually get broken into
Automated scripts scan thousands of sites a day. They look for an old plugin with a known hole, or a login page that still accepts "admin" and a weak password. A clinic in Al Nahda and a trading company in JAFZA look exactly the same to them.
So being small and unremarkable doesn't protect you. Being a slightly harder target than the next site usually does.
What happens after a break-in varies. Sometimes pages fill with spam links that only Google sees. Sometimes visitors get redirected to another site. Sometimes the server starts sending spam email until the host suspends your account. You often find out from a customer, or from a warning next to your listing in search results.
The padlock, and what it doesn't tell you
An SSL certificate is what puts https and the padlock in the address bar. It encrypts what travels between a visitor's phone and your site, so a form submission can't be read on the way.
Every site needs one. Browsers label pages without it "Not secure", which is a poor look next to a contact form. Our Premium and Business packages include SSL for the first year, and hosting renewal at AED 599 a year keeps it running after that.
But the padlock only describes the connection. It says nothing about whether the site behind it is up to date or clean, and a hacked site can show one perfectly well.
Two quick checks. Type your address without the www and without https, and make sure it still ends up on the secure version. Then find out when the certificate renews and whether that happens automatically. An expired one puts a full-page browser warning in front of every visitor.
Updates are most of website security
If your site runs on WordPress or a similar system, the software and its plugins get regular security fixes. Old versions with published weaknesses are exactly what those scanning scripts are hunting for.
Updates are boring, so they get skipped. A site built three years ago and never touched since is very likely running something with a known hole in it.
Two habits help. Delete plugins and themes you don't use, because switched-off code sitting on the server can still be a way in. And take a backup before each round of updates, since an update occasionally breaks something.
This is a large part of what our Care & support add-on covers, at AED 399 a month, alongside backups and security checks. You can do it yourself, though. A monthly reminder in your calendar and twenty minutes is often enough for a small site.
Passwords, two-factor and who holds the logins
Use a long, different password for every admin account and switch on two-factor authentication wherever it's offered. That covers the website admin, the hosting control panel, the domain account and the email inbox that receives password resets.
That last one matters more than people think. Whoever controls the reset inbox can take over everything else.
Then there's a problem that has nothing to do with hackers. A freelancer built the site years ago, registered the domain in their own name and kept the only admin login. Now they don't reply. Or a staff member who left last year still has an account.
Write a list of every account linked to the site, including Google Business Profile and analytics. Put them in the company's name, make sure at least two people in the business can get in, and remove anyone who no longer works with you. Our guide on choosing a web design company explains why domain and hosting ownership should be settled before you sign anything.
Hosting and backups you've actually restored
Almost every host says it takes backups. Far fewer owners have ever tried restoring one.
A backup you haven't tested is a hope. Some turn out to be missing the database. Others sit on the same server as the site, so they disappear with it. And a short history is its own problem: if copies only go back three days and the hack happened two weeks ago, every copy you have is already infected.
Ask your host where the backups are stored, how far back they go and when one was last restored. Keep at least one copy somewhere separate from your hosting, and restore it to a test copy once or twice a year to prove it works.
Hosting itself does part of the job. A decent host keeps the server software patched and walls your site off from the others sharing the machine. Very cheap shared hosting varies a lot on both, so ask before you buy.
Contact forms, spam and the data they collect
An unprotected contact form fills with spam within weeks. Most of it is junk, but some carries phishing links aimed at whoever reads the inbox.
On our sites we use Cloudflare Turnstile. It checks for bots in the background, and most real visitors never see a puzzle at all. That beats the old picture-grid captchas, which put customers off on small screens.
Forms also collect personal data, usually names and phone numbers and sometimes more sensitive details. The UAE has a federal personal data protection law, and some free zones such as DIFC and ADGM have their own data rules. We're not lawyers, so we won't tell you exactly what applies to your business. A sensible start is to collect only what you need and not leave submissions sitting in an inbox five people share. A short privacy page helps too.
If your site has been hacked
Don't start deleting files. Work through it in order.
First, change the hosting and website admin passwords from a computer you trust, then tell your host. They may have spotted it already and can often help roll the site back. Restore from a clean backup taken before the problem started, if you have one, and update everything straight away so the same hole can't be used twice.
With no clean backup, the site needs cleaning by someone who knows what to look for. It's slow, fiddly work and it isn't always cheaper than rebuilding the site. That's an unwelcome thing to hear after a hack, but it's often true for old sites.
Afterwards, check Google Search Console for security warnings and request a review once the site is clean. If customer data may have been exposed, take proper advice on what you need to tell people.
For a quick look at some of the basics on your current site, try our free website checker. If you'd rather someone else handled updates and backups every month, call or WhatsApp us on +971 52 292 3875.
Questions people ask
Does an SSL certificate make my website secure?
It protects data travelling between the visitor and the site. It doesn't stop the site itself being hacked through old software or weak passwords.
How often should website software be updated?
Check at least once a month and apply security fixes as soon as you can. Take a backup first.
Who should own the hosting and domain accounts?
The business, using a company email address more than one person can reach. Designers can be given their own access and removed when the work ends.
Is a captcha on my contact form necessary?
Some spam protection is, yes. We use Cloudflare Turnstile because most visitors pass without solving anything.
What's the first thing to do if my site gets hacked?
Change your passwords from a clean device and contact your hosting provider. Then restore a backup from before the problem, if you have a clean one.